The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from multiple sources including git log output, internal changelogs, sprint retrospectives, and balance change documents. These sources could contain malicious instructions designed to influence the agent's output during the translation and categorization phases.
Ingestion points: production/releases/[version]/changelog.md, docs/CHANGELOG.md, git log output, production/sprints/ retrospectives, design/balance/ documents, and QA bug fix records.
Boundary markers: The skill lacks explicit boundary markers or 'ignore instructions' warnings when processing this external content.
Capability inventory: The skill has access to Bash (for git log), Read (to ingest files), and Write (to save the final notes).
Sanitization: No explicit sanitization or filtering of instructions within the ingested data is mentioned beyond removing 'internal jargon'.
[PROMPT_INJECTION]: The skill text contains the phrase Verdict: BLOCKED. While in this context it is a natural part of the skill's logic for handling missing data, such phrases are often used by attackers to try and influence security analyzers. The analyzer has evaluated this and determined it to be a benign logical marker in this specific skill.

patch-notes